Episode 50 — Evaluate Third-Party Risk: Integrators, Remote Support, and Shared Responsibility

This episode teaches how to evaluate third-party risk in OT, because integrators and remote support providers often have the access and authority that determines whether controls are enforceable or merely aspirational. You’ll learn how to identify third-party roles, what systems they touch, what credentials and pathways they use, and what shared responsibility actually means when something fails, including who must detect, who must contain, and who must restore safely. We connect this to exam scenarios where vendor access is necessary but risky, emphasizing controls like dedicated jump hosts, MFA, session recording where appropriate, strict time-bound access, change approvals, and clear evidence requirements after work is performed. The episode also covers governance techniques such as contract language, SLAs for incident support, and periodic access reviews that prevent “temporary” accounts from becoming permanent backdoors. Troubleshooting considerations focus on responding when a third-party event is suspected, including preserving logs, verifying recent sessions, coordinating with legal and procurement, and implementing compensating controls that reduce risk without cutting off critical operational support. Produced by BareMetalCyber.com, where you’ll find more cyber audio courses, books, and information to strengthen your educational path. Also, if you want to stay up to date with the latest news, visit DailyCyber.News for a newsletter you can use, and a daily podcast you can commute with.